hasura / hasura/graphql-engine

Allow masking of error messages for security reasons

Open
#9,344 0 comments 3 reactions 0 assignees View on GitHub
k/enhancement t/security
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Issue

When using Hasura as our GraphQL endpoint we need a way to mask error messages as these might be too detailed and expose internal information regarding the schema/technologies we use.
This is actually a comment we got during SOC2 Compliance tests...

### Suggested solution

Similar to the HASURA_GRAPHQL_DEV_MODE environment variable, to have a ERRORS_DETAIL_LEVEL that helps mask the errors.
* The default level can be the errors as they are now
* Somewhat masked level can be just some general errors messages like "Authentication Error", "Parsing Error" etc
* The most masked level can be just "Error occurred"

Or any other solution :)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how HASURA_GRAPHQL_DEV_MODE affects errors exposed through the GraphQL endpoint. Compare the proposed default, partially masked, and fully masked levels, and define what information must no longer be revealed for SOC2 compliance. Done means error responses can be configured without exposing detailed schema or technology information.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
api, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.